Secure and Responsible Proxy Use

A proxy is a networking tool, and like any tool it should be used responsibly. These practices keep your work lawful, your accounts secure and your relationships with the sites you work with healthy.

This guide turns those principles into steps: what lawful use means, what a proxy does and does not protect, how to look after credentials, how to treat the sites you work with, how to handle data and what to do when something goes wrong. A checklist at the end is ready to copy into your team’s handbook.

1.Use proxies for lawful purposes

Use proxies for legitimate business activities such as testing, monitoring and collecting publicly available data. Make sure you have the right to access and use the data you collect, and never use proxies for fraud, malware or unauthorized access.

Our acceptable use policy draws the line in two lists. These are the permitted uses:

• Web scraping of publicly available data in compliance with robots.txt and the site’s terms
• SEO monitoring and SERP tracking
• Ad verification and brand protection
• Social media management for legitimate business accounts
• E-commerce price monitoring
• Research, testing and development, and secure web access for business operations

And these are prohibited, in every case:

• Illegal activity of any kind, and fraud, impersonation or other deceptive practices
• Phishing, malware, spam and unsolicited bulk messages
• Denial-of-service attacks, network intrusion and port scanning without authorization
• Credential stuffing and brute-force logins with stolen, leaked or guessed credentials
• Any access to systems, accounts or data without permission, and any content that exploits minors

Accounts that break these rules can be suspended or terminated without notice, and fees are not refunded in that case.

2.Know what a proxy does and does not protect

A proxy changes the IP address a website sees. It is not an encryption tool and it does not make your activity private. This table shows who can see what:

Xameleon keeps request logs for 90 days, as described in the Privacy Policy. Use HTTPS for anything sensitive, whatever proxy you use.

3.Protect your credentials

Keep proxy usernames and passwords private. Never share credentials in public repositories, keep them in environment variables or a secrets manager, and change them if you suspect they were exposed.

Access to a proxy is by login and password alone, so whoever holds them can use your proxy and your traffic allowance. A .env file that stays out of version control is the minimum for a project:

# .env  (never commit this file)
PROXY_USER=your-username
PROXY_PASS=your-password
PROXY_HOST=host:port

# .gitignore
.env

Passwords also leak through logs. This helper masks the password of any proxy URL before a line is printed or stored:

import re

def redact(text):
    """Masks the password of any proxy URL in a log line."""
    return re.sub(r"(://[^:/@\s]+:)[^@\s]+@", r"\1***@", text)

print(redact("failed via http://user:secret@host:8080 after 3 tries"))
# failed via http://user:***@host:8080 after 3 tries

If you suspect that the credentials were exposed, act in this order: change the password, check your usage for anything you do not recognize, remove the secret from your code and its history, and write to [email protected] if something looks wrong.

4.Use secure connections

• Prefer HTTPS for every site that offers it. The proxy then carries encrypted traffic it cannot read.
• Keep certificate checks on. A certificate error is a warning, not an obstacle to switch off.
• Use socks5h:// with SOCKS5, so that the proxy resolves names and your computer does not send them to a local DNS server.
• Never send passwords or tokens over plain HTTP, through any proxy.
• Keep your tools updated. Browsers, libraries and the operating system receive security fixes regularly.

import requests

# Do not do this: it switches the certificate check off
# requests.get(url, proxies=proxies, verify=False)

# Do this: keep the default check and fix your certificate store if it fails
r = requests.get(url, proxies=proxies, timeout=(5, 20))

5.Respect website rules

Read the terms of use and robots.txt of every site you work with. Keep request rates reasonable, avoid overloading servers and stop if a site asks you to.

• Identify your tool with a clear User-Agent and a contact address, so that a site owner can reach you.
• Honor 429 and Retry-After. They tell you to slow down and for how long.
• Prefer official APIs and feeds when a site offers them.
• Stop when asked. If a site owner asks you to stop, stop and talk to them.

The guide to web scraping at scale shows request budgets, throttling and retries in code.

6.Handle data responsibly

Collect only the data you need, store it securely and delete it when you no longer need it. When personal data is involved, follow privacy laws such as the GDPR.

• Minimize. Decide which fields you need before you collect, and leave the rest.
• Protect what you store. Restrict access to the people who need it and encrypt the storage where you can.
• Set a retention period and delete data when it expires, and when the law or a data subject requires it.
• Know your purpose. If you cannot say why you hold a piece of personal data, you probably should not.

This is general information, not legal advice. For a project that involves people’s data, ask a lawyer.

7.Run proxies safely in a team

• One proxy per project or client, each with its own connection details in your account, so that you can see and cut off access precisely.
• A register of who uses which proxy and why. A spreadsheet is enough.
• A password manager for sharing credentials, never chats or e-mail.
• Offboarding. When someone leaves, change the credentials they knew and update the register.
• A regular review, for example every quarter: remove proxies nobody uses and check the traffic against the plan.

8.Know our rules

Our Acceptable Use Policy lists prohibited activities, including fraud, phishing, malware, spam and unauthorized access. Accounts that break these rules can be suspended.

• Reporting abuse. Write to [email protected] with the subject “Abuse Report”. We review every report and act on confirmed violations.
• Verification. We may ask for information to verify a customer’s identity or intended use of the service.
• Logs. Request logs are kept for 90 days, as the Privacy Policy describes.
• Fair use. Excessive traffic that degrades the service for other users can lead to throttling or suspension.

9.If something goes wrong

10.A checklist to copy

Before you start

• The purpose is lawful, and I may use the data I will collect.
• I read the site’s terms and robots.txt, and there is no official API that does the job.
• The credentials are in environment variables or a secrets manager.

While you work

• HTTPS is on, and certificate checks are on.
• The request rate is low, the tool identifies itself and 429 is honored.
• Logs never contain a password.

After you finish

• Data I no longer need is deleted.
• Access of people who left is removed, and the register is current.

11.FAQs

Is it legal to use a proxy?

Using a proxy is legal in most countries. What decides legality is your purpose and your conduct: follow the law, the sites’ terms and our acceptable use policy.

Does a proxy protect my data?

Not by itself. A proxy changes the address a site sees. HTTPS protects the content of your traffic, and you protect your data by storing and handling it carefully.

How often should I change the proxy password?

Whenever you suspect it was exposed, when someone who knew it leaves, and on the schedule your own security policy sets. If you cannot change it yourself, ask our support.

What should I do if a site asks me to stop?

Stop the requests to that site and talk to its owner. Continuing against a clear request is not acceptable use.

How do I report abuse?

Write to [email protected] with the subject “Abuse Report”. We review every report and act on confirmed violations.

Still have questions about mobile proxies? Visit our FAQ page for detailed answers, or contact our support team — we're here to help.